USA v. Lifshits Document 2: Affidavit, Attachment 2

Virginia Eastern District Court
Case No. 1:20-mj-00256-TCB
Filed September 10, 2020

AFFIDAVIT by USA as to Artem Mikhaylovich Lifshits [1] Complaint (Attachments: # (1) Part II, # (2) Part III, # (3) Part IIII)(choy, )

BackBack to USA v. Lifshits

Tags No tags have been applied so far. Sign in to add some.

Jump to Document 2 or Attachment 123

  Formatted Text Tab Overlap Raw Text Right End
Page 1 PagelD#
66. On or about July 12, 2016, Defendants and their co-conspirators created and purchased
Facebook advertisements for the “Down With Hillary” rally in New York.
67. | Onor about July 23, 2016, Defendants and their co-conspirators used the email address of
a false U.S. persona, joshmilton024@gmail.com, to send out press releases to over thirty media
outlets promoting the “Down With Hillary” rally at Trump Tower in New York City.
68. Onor about July 28, 2016, Defendants and their co-conspirators posted a series of tweets
through the false U.S. persona account @March_for Trump stating that “[w]e’re currently
planning a series of rallies across the state of Florida” and seeking volunteers to assist.
69. On or about August 2, 2016, Defendants and their co-conspirators used the false U.S.
persona “Matt Skiber” Facebook account to send a private message to a real Facebook account,
“Florida for Trump,” set up to assist then-candidate Trump in the state of Florida. In the first
message, Defendants and their co-conspirators wrote:
Hi there! I’m a member of Being Patriotic online community. Listen,
we've got an idea. Florida is still a purple state and we need to paint
it red. If we lose Florida, we lose America. We can’t let it happen,
right? What about organizing a YUGE pro-Trump flash mob in
every Florida town? We are currently reaching out to local activists
and we’ve got the folks who are okay to be in charge of organizing
their events almost everywhere in FL. However, we still need your
support. What do you think about that? Are you in?
70. On or about August 2, 2016, and August 3, 2016, Defendants and their co-conspirators,
through the use of a stolen identity of a real U.S. person, T.W., sent emails to certain grassroots
groups located in Florida that stated in part:
My name is [T.W.] and I represent a conservative patriot community
named as “Being Patriotic.” . . . So we’re gonna organize a flash
mob across Florida to support Mr. Trump. We clearly understand
that the elections winner will be predestined by purple states. And
we must win Florida. ... We got a lot of volunteers in ~25 locations
and it’s just the beginning. We’re currently choosing venues for each
26
Page 2 PagelD#
location and recruiting more activists. This is why we ask you to
spread this info and participate in the flash mob.
71. On or about August 4, 2016, Defendants and their co-conspirators created and purchased
Facebook advertisements for the “Florida Goes Trump” rally. The advertisements reached over
59,000 Facebook users in Florida, and over 8,300 Facebook users responded to the advertisements
by clicking on it, which routed users to the ORGANIZATION’s “Being Patriotic” page.
72. Beginning on or about August 5, 2016, Defendants and their co-conspirators used the false
U.S. persona @March_for_Trump Twitter account to recruit and later pay a real U.S. person to
wear a costume portraying Clinton in a prison uniform at a rally in West Palm Beach.
73. Beginning on or about August 11, 2016, Defendants and their co-conspirators used the false
U.S. persona “Matt Skiber” Facebook account to recruit a real U.S. person to acquire signs and a
costume depicting Clinton in a prison uniform.
74. On or about August 15, 2016, Defendants and their co-conspirators received an email at
one of their false U.S. persona accounts from a real U.S. person, a Florida-based political activist
identified as the “Chair for the Trump Campaign” in a particular Florida county. The activist
identified two additional sites in Florida for possible rallies. Defendants and their co-conspirators
subsequently used their false U.S. persona accounts to communicate with the activist about
logistics and an additional rally in Florida.
#5: On or about August 16, 2016, Defendants and their co-conspirators used a false U.S.
persona Instagram account connected to the ORGANIZATION-created group “Tea Party News”
to purchase advertisements for the “Florida Goes Trump” rally.
76. On or about August 18, 2016, the real “Florida for Trump” Facebook account responded to
‘is false U.S. persona “Matt Skiber” account with instructions to contact a member of the Trump
Campaign (“Campaign Official 1”) involved in the campaign’s Florida operations and provided
27
Page 3 PagelD#
Campaign Official 1’s email address at the campaign domain donaldtrump.com. On
approximately the same day, Defendants and their co-conspirators used the email address of a false
U.S. persona, joshmilton024@gmail.com, to send an email to Campaign Official 1 at that
donaldtrump.com email account, which read in part:
Hello [Campaign Official 1], [w]e are organizing a state-wide event
in Florida on August, 20 to support Mr. Trump. Let us introduce
ourselves first. “Being Patriotic” is a grassroots conservative online
movement trying to unite people offline. ... [W]e gained a huge lot
of followers and decided to somehow help Mr. Trump get elected.
You know, simple yelling on the Internet is not enough. There should
be real action. We organized rallies in New York before. Now we’re
focusing on purple states such as Florida.
The email also identified thirteen “confirmed locations” in Florida for the rallies and requested the
campaign provide “assistance in each location.”
77. On or about August 18, 2016, Defendants and their co-conspirators sent money via
interstate wire to another real U.S. person recruited by the ORGANIZATION, using one of their
false U.S. personas, to build a cage large enough to hold an actress depicting Clinton in a prison
uniform.
78. On or about August 19, 2016, a supporter of the Trump Campaign sent a message to the
ORGANIZATION-controlled “March for Trump” Twitter account about a member of the Trump
Campaign (“Campaign Official 2”) who was involved in the campaign’s Florida operations and
provided Campaign Official 2’s email address at the domain donaldtrump.com. On or about the
same day, Defendants and their co-conspirators used the false U.S. persona
joshmilton024@gmail.com account to send an email to Campaign Official 2 at that
donaldtrump.com email account.
79. On or about August 19, 2016, the real “Florida for Trump” Facebook account sent another
message to the false U.S. persona “Matt Skiber” account to contact a member of the Trump
28
Page 4 PagelD#
Campaign (“Campaign Official 3”) involved in the campaign’s Florida operations. On or about
August 20, 2016, Defendants and their co-conspirators used the “Matt Skiber” Facebook account
to contact Campaign Official 3.
80. On or about August 19, 2016, Defendants and their co-conspirators used the false U.S.
persona “Matt Skiber” account to write to the real U.S. person affiliated with a Texas-based
grassroots organization who previously had advised the false persona to focus on “purple states
like Colorado, Virginia & Florida.” Defendants and their co-conspirators told that U.S. person,
“We were thinking about your recommendation to focus on purple states and this is what we’re
organizing in FL.” Defendants and their co-conspirators then sent a link to the Facebook event
page for the Florida rallies and asked that person to send the information to Tea Party members in
Florida. The real U.S. person stated that he/she would share among his/her own social media
contacts, who would pass on the information.
81. On or about August 24, 2016, Defendants and their co-conspirators updated an internal
ORGANIZATION list of over 100 real U.S. persons contacted through ORGANIZATION-
controlled false U.S. persona accounts and tracked to monitor recruitment efforts and requests.
The list included contact information for the U.S. persons, a summary of their political views, and
activities they had been asked to perform by Defendants and their co-conspirators.
82. Onor about August 31, 2016, Defendants and their co-conspirators, using a U.S. persona,
spoke by telephone with a real U.S. person affiliated with a grassroots group in Florida. That
individual requested assistance in organizing a rally in Miami, Florida. On or about September 9,
2016, Defendants and their co-conspirators sent the group an interstate wire to pay for materials
needed for the Florida rally on or about September 11, 2016.
29
Page 5 PagelD#
83. On or about August 31, 2016, Defendants and their co-conspirators created and purchased
Facebook advertisements for a rally they organized and scheduled in New York for September 11,
2016.
84. On or about September 9, 2016, Defendants and their co-conspirators, through a false U.S.
persona, contacted the real U.S. person who had impersonated Clinton at the West Palm Beach
rally. Defendants and their co-conspirators sent that U.S. person money via interstate wire as an
inducement to travel from Florida to New York and to dress in costume at another rally they
organized.
85. On or about September 22, 2016, Defendants and their co-conspirators created and
purchased Facebook advertisements for a series of rallies they organized in Pennsylvania called
“Miners for Trump” and scheduled for October 2, 2016.
All in violation of Title 18, United States Code, Section 371.
COUNT TWO
(Conspiracy to Commit Wire Fraud and Bank Fraud)
86. Paragraphs 1 through 7, 9 through 27, and 29 through 85 of this Indictment are re-alleged
and incorporated by reference as if fully set forth herein.
87. From in or around 2016 through present, in the District of Columbia and elsewhere,
Defendants INTERNET RESEARCH AGENCY LLC, DZHEYKHUN NASIMI OGLY
ASLANOV, and GLEB IGOREVICH VASILCHENKO, together with others known and
unknown to the Grand Jury, knowingly and intentionally conspired to commit certain offenses
against the United States, to wit:
a. to knowingly, having devised and intending to devise a scheme and artifice to
defraud, and to obtain money and property by means of false and fraudulent
30
Page 6 PagelD#
pretenses, representations, and promises, transmit and cause to be transmitted, by
means of wire communications in interstate and foreign commerce, writings, signs,
signals, pictures, and sounds, for the purposes of executing such scheme and
artifice, in violation of Title 18, United States Code, Section 1343; and
b. to knowingly execute and attempt to execute a scheme and artifice to defraud a
federally insured financial institution, and to obtain monies, funds, credits, assets,
securities and other property from said financial institution by means of false and
fraudulent pretenses, representations, and promises, all in violation of Title 18,
United States Code, Section 1344.
Obiect of the Conspiracy
88. The conspiracy had as its object the opening of accounts under false names at U.S. financial
institutions and a digital payments company in order to receive and send money into and out of
the United States to support the ORGANIZATION’ operations in the United States and for self-
enrichment.
Manner and Means of the Conspiracy
89. Beginning in at least 2016, Defendants and their co-conspirators used, without lawful
authority, the social security numbers, home addresses, and birth dates of real U.S. persons without
their knowledge or consent. Using these means of stolen identification, Defendants and their co-
conspirators opened accounts at a federally insured U.S. financial institution (“Bank 1”), including
the following accounts:
31
Page 7 PagelD#
Approximate Date Account Name Means of Identification










Tune 16, 2016 TB. Socta’ Security Number
uly 21, 2016 AR. ~~
July 27, 2016 re aS eet
August 2, 2016 TW. nee Ge
90. Defendants and their co-conspirators also used, without lawful authority, the social security
numbers, home addresses, and birth dates of real U.S. persons to open accounts at PayPal, a digital
payments company, including the following accounts:
Initials of Identity
BBM t utente Means of Identification
Approximate Date

Social Security Number
June 16, 2016 LE. Date of Birth

Social Security Number
July 21, 2016 ALR. Date of Birth

Social Security Number


August 2, 2016 T.W. Date of Birth
November 11, 2016 J.W. Home Address
January 18, 2017 VS. Social Security Number





Defendants and their co-conspirators also established other accounts at PayPal in the names of
false and fictitious U.S. personas. Some personas used to register PayPal accounts were the same
as the false U.S. personas used in connection with the ORGANIZATION’s social media accounts.
91. Defendants and their co-conspirators purchased credit card and bank account numbers from
online sellers for the unlawful purpose of evading security measures at PayPal, which used account
numbers to verify a user’s identity. Many of the bank account numbers purchased by Defendants
ae
Page 8 PagelD#
and their co-conspirators were created using the stolen identities of real U.S. persons. After
purchasing the accounts, Defendants and their co-conspirators submitted these bank account
numbers to PayPal.
92. On or about the dates identified below, Defendants and their co-conspirators obtained and
used the following fraudulent bank account numbers for the purpose of evading PayPal’s security
measures:















Aiphone Card/Bank Account CUE! Email Used to Acquire
Mtn liys g HERS eTaT eC) Account Number
June 13, 2016 XXXXXXXXX89(02 Bank 2 wemakeweather@gmail.com
June 16, 2016 XXXXXx8731 Bank | allforusa@yahoo.com
July 21, 2016 XXXXXX2215 Bank 3 antwan_8@yahoo.com
August 2, 2016 XXXXXX5707 Bank | xtimwaltersx@gmail.com
October 18, 2016 XXXXKXXXX5792 Bank 4 unitedvetsofamerica@gmail.com
October 18, 2016 XXXXXXXXX4743 Bank 4 patriototus@gmail.com
November 11, 2016 XXXXXXXXX2427 Bank 4 beautifullelly@gmail.com
November 11, 2016 XXXXXXXXX 7587 Bank 5 staceyredneck@gmail.com
November 11, 2016 XXXXXXXX7590 Bank 5 ihatecrime1@gmail.com
November 11, 2016 XXXXXXXX 1780 Bank 6 staceyredneck@gmail.com
November 11, 2016 RKO 762 Bank 6 ihatecrimel @gmail.com
December 13, 2016 XXXXXXXX6168 Bank 6 thetaylorbrooks@aol.com
March 30, 2017 XXXXXXXXX63 16 Bank 3 wokeaztec@outlook.com
March 30, 2017 XXXXxXx9512 Bank 3 wokeaztec@outlook.com





33
Page 9 PagelD#
93. Additionally, and in order to maintain their accounts at PayPal and elsewhere, including
online cryptocurrency exchanges, Defendants and their co-conspirators purchased and obtained
false identification documents, including fake U.S. driver’s licenses. Some false identification
documents obtained by Defendants and their co-conspirators used the stolen identities of real U.S.
persons, including U.S. persons T.W. and J.W.
94. After opening the accounts at Bank 1 and PayPal, Defendants and their co-conspirators
used them to receive and send money for a variety of purposes, including to pay for certain
ORGANIZATION expenses. Some PayPal accounts were used to purchase advertisements on
Facebook promoting ORGANIZATION-controlled social media accounts. The accounts were also
used to pay other ORGANIZATION-related expenses such as buttons, flags, and banners for
rallies.
95. Defendants and their co-conspirators also used the accounts to receive money from real
U.S. persons in exchange for posting promotions and advertisements on the ORGANIZATION-
controlled social media pages. Defendants and their co-conspirators typically charged certain U.S.
merchants and U.S. social media sites between 25 and 50 U.S. dollars per post for promotional
content on their popular false U.S. persona accounts, including Being Patriotic, Defend the 2nd,
and Blacktivist.
All in violation of Title 18, United States Code, Section 1349.
COUNTS THREE THROUGH EIGHT

(Aggravated Identity Theft)
96. Paragraphs 1 through 7, 9 through 27, and 29 through 85, and 89 through 95 of this
Indictment are re-alleged and incorporated by reference as if fully set forth herein.
97. On or about the dates specified below, in the District of Columbia and elsewhere,
34
Page 10 PagelD#
Defendants INTERNET RESEARCH AGENCY LLC, DZHEYKHUN NASIMI OGLY
ASLANOV, GLEB IGOREVICH VASILCHENKO, IRINA VIKTOROVNA KAVERZINA, and
VLADIMIR VENKOV did knowingly transfer, possess, and use, without lawful authority, a
means of identification of another person during and in relation to a felony violation enumerated
in 18 U.S.C. § 1028A(c), to wit, wire fraud and bank fraud, knowing that the means of
identification belonged to another real person:
Initials of Identity
Theft Victim Means of Identification
Count Approximate Date






3 June 16, 2016 TB. —_ cane
4 | July21,2016 AR. eee
5 July 27, 2016 no: social Security Number
6 | August 2, 2016 TW. Social Security Number
7 January 18, 2017 VS. Social Security Number
8 May 19, 2017 LW. Te nem






All in violation of Title 18, United States Code, Sections 1028A(a)(1) and 2.
FORFEITURE ALLEGATION
98. Pursuant to Federal Rule of Criminal Procedure 32.2, notice is hereby given to Defendants
that the United States will seek forfeiture as part of any sentence in accordance with Title 18,
United States Code, Sections 981 (a)(1)(C) and 982(a)(2), and Title 28, United States Code, Section
2461(c), in the event of Defendants’ convictions under Count Two of this Indictment. Upon
conviction of the offense charged in Count Two, Defendants INTERNET RESEARCH AGENCY
LLC, DZHEYKHUN NASIMI OGLY ASLANOV, and GLEB IGOREVICH VASILCHENKO
35
Page 11 PagelD#
shall forfeit to the United States any property, real or personal, which constitutes or is derived from
proceeds traceable to the offense of conviction. Upon conviction of the offenses charged in Counts
Three through Eight, Defendants INTERNET RESEARCH AGENCY LLC, DZHEYKHUN
NASIMI OGLY ASLANOV, GLEB IGOREVICH VASILCHENKO, IRINA VIKTOROVNA
KAVERZINA, and VLADIMIR VENKOV shall forfeit to the United States any property, real or
personal, which constitutes or is derived from proceeds traceable to the offense(s) of conviction.
Notice is further given that, upon conviction, the United States intends to seek a Judgment against
each Defendant for a sum of money representing the property described in this paragraph, as
applicable to each Defendant (to be offset by the forfeiture of any specific property).
Substitute Assets
99. Ifany of the property described above as being subject to forfeiture, as a result of any act or
omission of any defendant --
a. cannot be located upon the exercise of due diligence;
b. has been transferred or sold to, or deposited with, a third party;
Ci has been placed beyond the jurisdiction of the court;
d. has been substantially diminished in value; or
e. has been commingled with other property that cannot be subdivided without
difficulty;
36
Page 12 PagelD#
it is the intent of the United States of America, pursuant to Title 18, United States Code, Section
982(b) and Title 28, United States Code, Section 2461(c), incorporating Title 21, United States
Code, Section 853, to seek forfeiture of any other property of said Defendant.
(18 U.S.C. §§ 981(a)(1)(C) and 982; 28 U.S.C. § 2461(c))
CL Mabo=
Robert S. Mueller, II
Special Counsel
U.S. Department of Justice
A TRUE BILL:

Foreperson
Date: February __,
37
Page 13 PagelD#
Attachment B
Page 14 PagelD#


bp
IN THE UNITED STATES DISTRICT COURT FOR TH
SEP 28 2018 |


EASTERN DISTRICT OF VIRGINIA

CLERK, U.S. DISTRICT COURT
ALEXANDRIA, VIRGINIA
Alexandria Division
UNITED STATES OF AMERICA )
)
v. ) Case No. 1:18-MJ-)
ELENA ALEKSEEVNA KHUSYAYNOVA, ) 18 U.S.C. § ) (Conspiracy)
Defendant. )
) UNDER SEAL
AFFIDAVIT IN SUPPORT OF A CRIMINAL COMPLAINT
I, David Holt, being duly sworn under oath, do hereby depose and state:
INTRODUCTION
1. I am a Special Agent with the Federal Bureau of Investigation (“FBI”) and have
been so employed since August 2008. I am presently assigned to the Washington Field Office
where I am responsible for investigations of foreign influence operations and other national
security matters with a cyber nexus. I have also conducted national security investigations of
foreign intelligence services and the targeting of critical U.S. infrastructure. As a Special Agent,
I have received specialized training and instruction in the field of national security investigations
and am authorized to investigate violation of laws of the United States and to execute warrants
issued under the authority of the United States.
Zz I am submitting this affidavit in support of a criminal complaint and arrest
warrant charging the defendant, ELENA ALEKSEEVNA KHUSYAYNOVA, with Conspiracy
to defraud the United States, in violation of Title 18, United States Code, Section 371.
3. The statements contained in this Affidavit are based on my experience and
background as a criminal investigator, on information provided to me by other members of the
Page 1 of 38
Page 15 PagelD#
FBI and other law enforcement officers, court records and documents, business records,
interviews, publicly available information, and my review of physical and documentary
evidence. I have personally participated in the investigation of the offense set forth below and,
as a result of my participation and review of evidence gathered in the case, I am familiar with the
facts and circumstances of this investigation. Since this Affidavit is being submitted for the
limited purpose of supporting a criminal complaint, I have not included every fact resulting from
the investigation. I have set forth only the facts that I believe are necessary to establish probable
cause to believe the above-named defendant has violated Title 18, United States Code, Section
371, as set forth herein.
RELEVANT STATUTES AND BACKGROUND
4, Title 18, United States Code, Section 371, makes it a federal crime if ‘two or
more persons conspire . . . to defraud the United States, or any agency thereof in any manner or
for any purpose, and one or more of such persons do any act to effect the object of the
conspiracy.”
a: The United States of America, through its departments and agencies, regulates the
activities of foreign individuals and entities in and affecting the United States in order to prevent,
disclose, and counteract improper foreign influence on U.S. elections and on the U.S. political |
system. U.S. law bans foreign nationals from making certain expenditures or providing things of
value for the purpose of influencing federal elections. U.S. law also bars agents of any hieien
entity from engaging in political activities within the United States without first registering with
the Attorney General. Various federal agencies, including the U.S. Department of Justice and
the Federal Election Commission, are charged with enforcing these laws.
Page 2 of 38
Page 16 PagelD#
6. The U.S. Department of Justice administers the Foreign Agent Registration Act
(“FARA”), Title 22, United States Code, Section 611 et seg. FARA establishes a registration,
reporting, and disclosure regime for agents of foreign principals (which includes foreign non-
government individuals and entities) so that the U.S. government and the people of the United
States are informed of the source of information and the identity of persons attempting to
influence U.S. public opinion, policy, and law. FARA requires, among other things, that persons
subject to its requirements submit periodic registration statements containing truthful information
about their activities and the income earned from them. Disclosure of the required information
allows the federal government and the American people to evaluate the statements and activities
of such persons in light of their function as foreign agents,
7. The Federal Election Commission is a federal agency that administers the Federal
Election Campaign Act (“FECA”), Among other things, FECA prohibits foreign nationals from
making “‘a contribution or donation of money or other thing of value, or to make an express or
implied promise to make a contribution or donation, in connection with a Federal, State, or local
election.” 52 U.S.C. § 30121(a)(1)(A). FECA also requires that individuals or entities who
make certain independent expenditures in federal elections report those expenditures to the
Federal Election Commission. The reporting requirements permit the Federal Election
Commission to fulfill its statutory duties of providing the American public with accurate data
about the financial activities of individuals and entities supporting federal candidates, and
enforcing FECA’s limits and prohibitions, including the ban on foreign expenditures.
Page 3 of 38
Page 17 PagelD#
STATEMENT OF PROBABLE CAUSE
L. Project Lakhta and Efforts to Interfere with U.S. Political System
8. Since at least 2014, known and unknown individuals, operating as part of a
broader Russian effort known as “Project Lakhta,” have engaged in political and electoral
interference operations targeting populations within the Russian Federation and in various other
countries, including, but not limited to, the United States, members of the European Union, and
Ukraine. Since at least May 2014, Project Lakhta’s stated goal in the United States was to
spread distrust towards candidates for political office and the political system in general.
9. Beginning in or around mid-2014 and continuing to the present, Project Lakhta
obscured its conduct by operating through a number of Russian entities, including Internet
Research Agency LLC (“IRA”), Internet Research LLC, MediaSintez LLC, GlavSet LLC,
MixInfo LLC, Azimut LLC, Novinfo LLC, Nevskiy News LLC (a/k/a “NevNov’”’), Economy
Today LLC, National News LLC, Federal News Agency LLC (a/k/a “FAN”), and International
News Agency LLC (a/k/a “MAN”). These entities employed hundreds of individuals in support
of Project Lakhta’s operations with an annual global budget of millions of U.S. dollars. Only
some of Project Lakhta’s activities ete directed at the United States.
10. | Concord Management and Consulting LLC and Concord Catering (collectively
“Concord”) are related Russian entities with various Russian government contracts. Concord
was the primary source of funding for Project Lakhta operations. Concord controlled funding,
recommended personnel, and oversaw Project Lakhta activities through reporting and interaction
with the management of the various Project Lakhta entities.
11. | Yevgeniy Viktorovich Prigozhin is a Russian oligarch who is closely identified
with Russian President Vladimir Putin. Prigozhin began his career in the food and restaurant
Page 4 of 38
Page 18 PagelD#
business and is sometimes referred to as “Putin’s Chef.” Prigozhin controls Concord, which has
been paid by the Russian government to feed school children and the military. Concord and
Prigozhin spent significant funds to further the Project Lakhta operations.
12. On February 16, 2018, a grand jury in the District of Columbia returned an
indictment charging thirteen Russian nationals and three Russian companies, including
Prigozhin, the IRA, and Concord, with committing federal crimes while seeking to interfere with
U.S. elections and political processes, including the 2016 presidential election. Indictment,
United States v. Internet Research Agency, et al., 1:18-CR-32 (DLF) (D.D.C. Feb. 16, 2018).
Based on my training and experience, the factual allegations in that indictment provide further
probable cause to believe that the above-named defendant has violated Title 18, United States
Code, Section 371. That indictment is attached hereto and incorporated by reference.
i, ELENA ALEKSEEVNA KHUSYAYNOVA
13. Defendant ELENA ALEKSEEVNA KHUSYAYNOVA is a resident of St.
Petersburg, Russia. Since at (ease 2014, the defendant has been employed by various entities
within Project Lakhta, including the IRA, GlavSet, and the Federal News Agency. Since
approximately April 2014, she has acted as the Chief Accountant in Project Lakhta’s finance
department. As detailed further herein, KHUSYAYNOVA oversaw all aspects of Project Lakhta
financing. She managed the budgeting and payment of expenses associated with social media
operations, web content, advertising campaigns, infrastructure, salaries, travel, office rent,
furniture, and supplies, and the registration of legal entities used to further Project Lakhta
activities,
14. | There is probable cause to believe that, from at least 2014 to the present,
KHUSYAYNOVA conspired with persons known and unknown to defraud the United States by
Page 5 of 38
Page 19 PagelD#
impairing, obstructing, and defeating the lawful functions of the U.S. Department of Justice and
Federal Election Commission in administering federal requirements for disclosure of foreign
involvement in certain domestic activities, in violation of Title 18, United States Code, Section
371. Among the persons with whom KHUSYAYNOVA conspired are known and unknown
enmavees and associates of Concord and Project Lakhta entities. The Conspiracy had as its
objects impairing, obstructing, and defeating the lawful governmental functions of the United
States by dishonest means in order to enable Project Lakhta actors to interfere with U.S. political
and electoral processes, including the 2018 U.S. elections.
Ill. Manner and Means of the Conspiracy
15. The Conspiracy has a strategic goal, which continues to this day, to sow division
and discord in the U.S. political system, including by creating social and political polarization,
undermining faith in democratic institutions, and influencing U.S. elections, including the
upcoming 2018 midterm election. The Conspiracy has sought to conduct what it called
internally “information warfare against the United States of America’! through fictitious U.S.
personas on social media platforms and other Internet-based media.
16. Members of the Conspiracy, posing as U.S. persons, operated fictitious social
media personas, pages, and groups designed to attract U.S. audiences and to address divisive
U.S. political and social issues or advocate for the election or electoral defeat of particular
candidates. These personas, groups, and pages falsely claimed to be controlled by U.S. activists
when, in fact, they were controlled by members of the Conspiracy. Over time, these accounts

' Throughout this affidavit, statements by members of the Conspiracy are translated or quoted
exactly as they appear in the source text, including any spelling, grammatical, or factual errors.
Page 6 of 38
Page 20 PagelD#
became the Conspiracy’s primary means to reach significant numbers of Americans for purposes
of interfering with the U.S. political system.
17. Members of the Conspiracy made various expenditures to carry out those
activities, including buying social media analytics products and services, as well as
advertisements on social media, in some instances through third-party intermediaries. Members
of the Conspiracy also staged and promoted political rallies inside the United States, and while
posing as U.S. grassroots entities and U.S. persons, and without revealing their Russian identities
and Project Lakhta affiliation, promoted or disparaged candidates and campaigns and organized
rallies and counter-protests around particular socially divisive issues.
A, KHUSYAYNOVA’s Role in Project Lakhte
18. Toeffectively manage such a large-scale operation, the Conspiracy was headed
by a management group and organized into departments, including a design and graphics
department, an analysts department, a search-engine optimization (“SEO”) department, an
information-technology (“IT”) department, and a finance department.
19. Between April 2014 and the present, KHUSYAYNOVA, as the Chief Accountant
in Project Lakhta’s finance department, managed the financing of substantially all aspects of
Project operations, which included media and influence activities directed at the United States,
the European Union, and Ukraine, as well as the Russian Federation. In that role, she oversaw
the budgets of various Project Lakhta entities, including the IRA, MediaSintez LLC, GlavSet
LLC, MixInfo LLC, Azimut LLC, NovInfo LLC, Nevskiy News LLC, Economy Today LLC,
National News LLC, Federal News Agency LLC, and International News Agency LLC.
KHUSYAYNOVA participated in the preparation and submission of hundreds of financial
vouchers, budgets, and payment requests for the various Project Lakhta entities, often putting all
Page 7 of 38
Page 21 PagelD#
company names on the same paperwork and identifying them as part of Project Lakhta.
KHUSYAYNOVA maintained Project Lakhta monthly budgets and submitted associated
| requests for funds to the central finance offices of Concord, which were responsible for
disbursing money to Project Lakhta entities.
20. To conceal the nature of Project Lakhta activities, since at least January 2016 the
Conspiracy labeled the funds paid by Concord to Project Lakhta as payments related to software
support and development. Moreover, since at least January 2016, Concord distributed funds to
Project Lakhta through approximately fourteen bank accounts held in the names of Concord
affiliates, including Glavnaya Liniya LLC, Merkuriy LLC, Obshchepit LLC, Potentsial LLC,
RSP LLC, ASP LLC, MTTs LLC, Kompleksservis LLC, SPb Kulinariya LLC, Almira LLC,
Pishchevik LLC, Galant LLC, Rayteks LLC, and Standart LLC. The Conspiracy described
payments from these Concord entities to Project Lakhta as being in furtherance of a series of
vague contracts that obscured or falsely stated the true intended use of the funds. At various
times, such payments were described as being for “providing services to collect and process
materials,” “providing services in developing an exporting module for results,” and “providing
services for developing a statistical processing module” (preliminary translation of Russian text).
21. Atthe same time, KHUSYAYNOVA kept detailed financial documents that
tracked itemized Project Lakhta expenses, including efforts to promote the illegal objects of the
Conspiracy in the United States. For example, the financial documents included itemized
budgets that included IT expenses, social media marketing expenses, and expenses for activities
in the United States and the European Union, including expenditures for activists and
advertisements on social media platforms, KHUSYAYNOVA also issued and kept track of
requests to Concord for funds to cover those expenses. Between at least January 2016 and July
Page 8 of 38
Page 22 PagelD#
2018, these documents were updated and provided to Concord on approximately a monthly
basis. The following illustrative examples demonstrate KHUSYA YNOVA’s meticulous record-
keeping and management of Project Lakhta funds:
a. In or around January 2017, KHUSYAYNOVA compiled and submitted to
Concord a planned itemized budget for February 2017 for Project Lakhta totaling
approximately 60 million Russian rubles (approximately $1 million U.S. dollars).
This budget also contained a backward-looking accounting of actual expenses for
calendar year 2016, which totaled approximately 720 million Russian rubles
(approximately $12 million U.S. dollars). In addition to administrative expenses,
such as office rent, utility payments, and garbage disposal, the budget identified
IT expenses, such as “registration of domain names” and the purchase of “proxy
servers;” and social media marketing expenses, such as expenses for “purchasing
posts for social networks,” “[a]dvertisement on Facebook,” “[a]dvertisement on
VKontakte,” “[a]dvertisement on Instagram,” “[p]romoting news postings on
social networks,” and social media optimization software (such as Twidium and
Novapress) (preliminary translation of Russian text). The budgets also contained
a section on “USA, EU” activities, which included itemized expenditures for
“Instagram,” “Facebook advertisement,” and “Activists” eelientnaey translation
of Russian text). Moreover, the budgets identified expenditures for “bloggers”
and “developing accounts” on Twitter, and for the development and promotion of
online videos (preliminary translation of Russian text).

? For the purpose of this affidavit, the approximate U.S. dollar values are based on an
approximate currency conversion rate of 60 Russian rubles to 1 U.S. dollar.
Page 9 of 38
Page 23 PagelD#
b. To cover the February 2017 expenses, KHUSYAYNOVA requested funds from
Concord in two:parts. KHUSYAYNOVA requested approximately 25 million
Russian rubles on or about February 16, 2017, and approximately 35 million
Russian rubles on March 6, 2017.
c. Inor around January 2018, KHUSYAYNOVA compiled and submitted to
Concord a planned itemized budget for February 2018 totaling approximately million Russian rubles (approximately $1.7 million U.S. dollars). This budget
also contained a backward-looking accounting of actual expenses fendtendar
year 2017, which totaled approximately 733 million Russian rubles
(approximately $12.2 million U.S. dollars), The budget contained, among other
things, all of the categories of itemized expenditures identified in subparagraph a,
above. |
d. To cover substantial portions of the February 2018 expenses, KHUSYAYNOVA
requested funds from Concord in at least six parts. KHUSYAYNOVA requested
approximately 20 million Russian rubles on or about February 7, 2018,
approximately 10 million Russian rubles on or about February 7, 2018,
approximately 15 million Russian rubles on or about February 16, 2018,
approximately 3 million Russian rubles on or about February 21, 2018,
approximately 5 million Russian rubles on or about February 28, 2018, and
approximately 31 million Russian rubles on or about March 6, 2018.
e. In or around March 2018, KHUSYAYNOVA compiled and submitted to Concord
a monthly budget for April 2018 for Project Lakhta that exceeded 107 million
Page 10 of 38
Page 24 PagelD#
Russian rubles (over $1.75 million U.S, dollars). The budget contained, among
other things, all of the itemized expenditures identified in subparagraph a, above.
To cover substantial portions of the April 2018 expenses, KHUSYAYNOVA
requested funds from Concord in at least two parts. KHUSYAYNOVA requested
approximately 32 million Russian rubles on or about April 6, 2018, and
approximately 21 million Russian rubles on or about May 8, 2018.
. In oraround April 2018, KHUSYAYNOVA compiled and submitted to Concord
a monthly budget for May 2018 for Project Lakhta that exceeded 111 million
Russian rubles (over $1.86 million U.S. dollars). The budget contained, among
other things, all of the categories of itemized expenditures identified in
subparagraph a, above.
. To cover substantial portions of the May 2018 expenses, she requested funds from
Concord in at least three parts. She requested approximately 5 million Russian
rubles on or about May 8, 2018, approximately 31 million oe rubles on or
about May 10, 2018, and approximately 35 million Russian rubles on or about
June 9, 2018.
On or about June 1, 2018, KHUSYAYNOVA compiled and submitted to Concord
a monthly budget for June 2018 for Project Lakhta that exceeded 114 million
Russian rubles (over $1.9 million U.S. dollars). The budget contained, among
other things, all of the categories of itemized expenditures identified in
subparagraph a, above.
To cover substantial portions of the June 2018 expenses, KHUSYAYNOVA
requested funds from Concord in three parts. KHUSYAYNOVA requested
Page 11 of 38
Page 25 PagelD#
approximately 29 million Russian rubles on or about June 1, 2018, approximately
29 million Russian rubles on or about June 4, 2018, and approximately 36 million
Russian rubles on July 10, 2018.
22. Between in or around January 2016 and in or around June 2018, Project Lakhta’s
proposed operating budget totaled more than 2 billion Russian rubles (over $35 million U.S.
dollars). Just between in or around January 2018 and in or around June 2018, Project Lakhta’s
proposed operating budget totaled more than 650 million Russian rubles (over $10 million U.S.
dollars),
23. KHUSYAYNOVA also monitored the Project Lakhta budget to ensure that
expected payments from Concord were received, For example, on or about November 15, 2017,
KHUSYAYNOVA contacted Concord to inform them that she had not received a payment from
Almira LLC for certain Project Lakhta companies, and that she was urgently waiting for the
payment. Similarly, on or about April 11, 2018, KHUSYAYNOVA confirmed to Concord that
dite had received payment for a portion of the March 2018 budget for Project Lakhta but was
waiting for the remaining payment. On or about April 12, 2018, a Concord employee informed
KHUSYAYNOVA that the remaining payment would be forthcoming.
24. Starting at least in or around 2015, the Conspiracy began to purchase
advertisements on online social media sites to promote events and social media groups it
controlled. These expenditures were included in the budgets that KHUSYAYNOVA submitted
to Concord. For example, between approximately January 2018 and June 2018,
KHUSYAYNOVA compiled and submitted to Concord expenditures of over 3.7 million Russian
rubles (over $60,000 U.S. dollars) for advertisements on Facebook and over 385,000 Russian
rubles (over $6,000 U.S. dollars) for advertisements on Instagram. Over that same timeframe,
Page 12 of 38
Page 26 PagelD#
the budget also included expenditures of over 1,100,000 Russian rubles (over $18,000 U.S.
dollars) for “bloggers” and “[dJeveloping accounts” on Twitter (preliminary translation of
Russian text). Additionally, the budget included expenditures for “[rJenting software for social
networks,” including payments for services to manage Twitter posts and generate additional
followers (preliminary translation of Russian text).
B. Targeted Messaging to Sow Social and Political Discord
25. Between in or around December 2016 and in or around May 2018, as part of the
Conspiracy’s effort to sow discord in the U.S. political system, members of the Conspiracy used
social media and other internet platforms to inflame passions on a wide variety of topics,
including immigration, gun control and the Second Amendment, the Confederate flag, race
relations, LGBT issues, the Women’s March, and the NFL national anthem debate. Members of
the Conspiracy took advantage of specific events in the United States to anchor their themes,
including the shootings of church members in Charleston, South Carolina, and concert attendees
in Las Vegas, Nevada; the Charlottesville “Unite the Right” rally and associated violence; police
shootings of African-American men; as well as the personnel and policy decisions of the current
U.S. administration.
26. Members of the Conspiracy were directed to create “political intensity through
supporting radical groups, users dissatisfied with [the] social and economic situation and
oppositional social movements.” The Conspiracy also sought, in the words of one member of
the Conspiracy, to “effectively aggravate the conflict between minorities and the rest of the
population.”
27. The Conspirators’ activities did not exclusively adopt one ideological viewpoint;
they wrote on topics from varied and sometimes opposing perspectives. Members of the
Page 13 of 38
Page 27 PagelD#
Conspiracy also developed strategies and guidance to target audiences with conservative and
liberal viewpoints, as well as particular social groups. For example, a member of the Conspiracy
advised in or around October 2017 that “if you write posts in a liberal group, . . . you must not
use Breitbart titles. On the contrary, if you write posts in a conservative group, do not use
Washington Post or BuzzFeed’s titles.” Using the example of individuals of color who are also
members of the lesbian, gay, bisexual, and transgender (“LGBT”) community, the member of the
Conspiracy offered the following guidance on how to target the group:
Colored LGBT are less sophisticated than white; therefore, complicated
phrases and messages do not work. Be careful dealing with racial content.
Just like ordinary Blacks, Latinos, and Native Americans, colored LGBT
people are very sensitive towards #whiteprivilege and they react to posts
and pictures that favor white people. ... Unlike with conservatives,
infographics works well among LGBT and their liberal allies, and it does
work very well. However, the content must be simple to understand
consisting of short text in large font and a colorful picture. (Preliminary
translation of Russian text.)
Members of the Conspiracy also sought to target the timing of their posts to attract the widest
possible viewership. The same member of the Conspiracy referenced above offered the
following guidance on how to overcome the time difference between Russia and the United
States:
Posting can be problematic due to time difference, but if you make your
re-posts in the morning St. Petersburg time, it works well with liberals —
LGBT groups are often active at night. Also, the conservative can view
your re-post when they wake up in the morning if you post it before you
leave in the evening St. Petersburg time. (Preliminary translation of
Russian text.)
28. | Members of the Conspiracy also developed detailed analysis of timely news
articles and guidance for how to describe the articles in social media posts in order to promote
the objectives of the Conspiracy. For example, in or around early August 2017, one or more
members of the Conspiracy working under the guise of the Facebook group “Secured Borders”
Page 14 of 38
Page 28 PagelD#
analyzed a large quantity of U.S. news articles, summarized the substance of the articles, and
outlined ways for the conspiracy to promote them. Specifically, one or more members of the
Conspiracy described each article and categorized its theme, provided a strategic response with a
particular focus on how to target U.S. audiences, and-then noted approval to use the strategic
response. The strategic response was referred to as ““Tasking Specifics,” which appeared to
include an assignment to certain members of the Conspiracy to disseminate the message on
social media platforms.
a. Citing an online news article titled “McCain Says Thinking a Wall Will Stop
Illegal Immigration is ‘Crazy,’” from on or about August 5, 2017, a member of
the Conspiracy directed that the article be messaged in the following way:
Brand McCain as an old geezer who has lost it and who long ago
belonged in a home for the elderly. Emphasize that John McCain’s
pathological hatred towards Donald Trump and towards all his
initiatives crosses all reasonable borders and limits. State that
dishonorable scoundrels, such as McCain, immediately aim to
destroy all the conservative voters’ hopes as soon as Trump tries to
fulfill his election promises and tries to protect the American
interests. (Preliminary translation of Russian text.)
b. Citing an online news article titled “Paul Ryan Opposes Trump’s Immigration
Cuts, Wants Struggling American Workers to Stay Poor,” from on or about
August 5, 2017, a member of the Conspiracy directed that the article be messaged
in the following way:
Brand Paul Ryan a complete and absolute nobody incapable of any
decisiveness. Emphasize that while serving as Speaker, this two-
faced loudmouth has not accomplished anything good for America
or for American citizens, State that the only way to get rid of Ryan
from Congress, provided he wins in the 2018 primaries, is to vote
in favor of Randy Brice, an American veteran and an iron worker
and a Democrat. (Preliminary translation of Russian text.)
Page 15 of 38
Page 29 PagelD#
c. Citing an online news article titled “11 California Counties Might have More
Registered Voters Than Eligible,” from on or about August 6, 2017, a member of
the Conspiracy directed that the article be messaged in the following way:
- In the California voter registration rolls, there are more registrants
than there are residents. This is the time for American
conservatives to sound the alarm before the elections turn the
Constitution into a mockery and a celebration of lawlessness.
Emphasize that previous falsifications during the U.S. elections
used to be perceived as a myth; today they became a reality with a
threatening force and are perceived accordingly. Emphasize that
all illegal voters must be kept away from the ballot boxes at
distances “beyond artillery firing range.” There is an urgent need
to introduce voter IDs for all the states, above all in the blue
(liberal and undecided) states. Remind that the majority of the
“blue states” have no VOTER IDs, which suggests that large-scale
falsifications are bound to be happening there. State in the end that
the Democrats in the coming election will surely attempt to falsify
the results. (Preliminary translation of Russian text.)
d. Citing an online news article titled “Savage: Civil War if Trump Taken Down,”
from on or about Au gust 6, 2017, a member of the Conspiracy directed that the
article be messaged in the following way:
Forcefully support Michael Savage’s point of view with
competence and honesty. Savage made it clear that any attempt to
remove Trump is a direct path to a civil war in the United States.
Name those who oppose the president and those who impede his
efforts to implement his pre-election promises. Focus on the fact
that the Anti-Trump Republicans: a) drag their feet with regard to
financing the construction of the border wall; b) are not lowering
taxes; c) slander Trump and harm his reputation (bring up
McCain); d) do not want to cancel Obamacare; e) are not in a hurry
to adopt laws that oppose the refugees coming from Middle
Eastern countries entering this country. Summarize that in case
Republicans will not stop acting as traitors, they will bring upon
themselves forces of civil retribution during the
elections. (Preliminary translation of Russian text.)
Page 16 of
a: sRRENTORERREENNNNE
Page 30 PagelD#
e. Citing an online news article titled “Trump: No Welfare To Migrants For Grants
For First 5 Years” from on or about August 6, 2017, a member of the Conspiracy
directed that the article be messaged in the following way:
Fully support Donald Trump and express the hope that this time
around Congress will be forced to act as the president says it
should, Emphasize that if Congress continues to act like the
Colonial British government did before the War of Independence,
this will call for another revolution. Summarize that Trump once
again proved that he stands for protecting the interests of the
United States of America. (Preliminary translation of Russian
text.)
f. Citing an online news article titled “The 8 Dirtiest Scandals of Robert Mueller No
One Is Talking About,” from on or about August 7, 2017, a member of the
Conspiracy directed that the article be messaged in the following way:
Special prosecutor Mueller is a puppet of the establishment. List
scandals that took place when Mueller headed the FBI. Direct
attention to the listed examples. State the following: It is a fact
that the Special Prosecutor who leads the investigation against
Trump represents the establishment: a politician with proven
connections to the U.S. Democratic Party who says things that
should either remove him from his position or disband the entire
investigation commission. Summarize with a statement that
Mueller is a very dependent and highly politicized figure;
therefore, there will be no honest and open results from the
investigation. Emphasize that the work of this commission is
damaging to the country and is aimed to declare impeachment of
Trump. Emphasize that it cannot be allowed, no matter what.
(Preliminary translation of Russian text.)
g. Citing an online news article titled “CNN’s Pro-Jeb! Republican: Trump White
House Like a ‘Brothel,’” from on or about August 7, 2017, a member of the
Conspiracy directed that the article be messaged in the following way:
CNN commentator “RINO” likened the Trump administration to a
“brothel.” Mass News Media Criticism! Accuse CNN of yet
another lie. State that during past elections, namely, this
mainstream media, which supported Hillary Clinton’s candidacy
Page 17 of 38
Page 31 PagelD#
for U.S. President almost 100%, disseminated fake news, insulting
statements, and lies about Donald Trump and his supporters. This
continues now. This is precisely why such news sources as the
New York Times, Washington Post, CNN, CBS, Time, and
Huffington Post must not be taken seriously, for they are the main
propaganda channels that are screwing with the heads of American
citizens. Remind readers that each of the above-mentioned media
resources supported Hillary Clinton and received funds from her
election fund. They produced fake social study research results at
polls predicting a Clinton win with a 10-15% lead over Trump and
tried hard to insult and discredit Trump. Summarize with a
statement that CNN long ago lost its reputation as a trusted source
and that its reputation is still declining. (Preliminary translation of
Russian text.)
h. Citing an online news article titled “Pro-Amnesty Sen. Marco Rubio: Trump’s _
Immigration Bill Will Not Pass the Senate,” from on or about August 7, 2017, a
member of the Conspiracy directed that the article be messaged in the following
way:
VERY IMPORTANT! We expose Marco Rubio as a fake
conservative who is a traitor to Republican values and who in his
soul despises the American Constitution and civil liberties.
Remind that Rubio is the protégé of the preposterous Jeb Bush,
who is a disgrace to the conservative movement. State that victims
of violence committed by illegals and the relatives of the victims
hate Marco Rubio completely and wholeheartedly. In other words,
Rubio is a liberal who penetrated the Republican Party for the
purpose undermining it from the inside. Summarize in a statement
that voting for Rubio during the Senate elections is practically the
same as voting for Hillary Clinton. (Preliminary translation of
Russian text.)
i. Citing an online news article titled “Sanctuary City Objects to Arrest of Accused
Illegal Alien Child Molester,” from on or about August 7, 2017, a member of the
Conspiracy directed that the article be messaged in the following way:
Characterize the position of Californian sanctuary cities along with
the position of the entire California administration as absolutely
and completely treacherous and disgusting. Stress that protecting
an illegal rapist who raped an American child is the peak of
Page 18 of 38
Page 32 PagelD#
wickedness and hypocrisy. Summarize in a statement that
“sanctuary city” politicians should surrender their American
citizenship, for they behave as true enemies of the United States of
America. (Preliminary translation of Russian text.)
j. Citing an online news article titled “Maryland City Mulling Over Idea to Let
Illegal Immigrants Vote” from on or about August 7, 2017, a member of the
Conspiracy directed that the article be messaged in the following way:
Stress that the leadership in sanctuary cities has lost all connection
with reality and is trying to provide criminals who illegally crossed
the U.S. borders with voting rights that are available only to the
citizens of the United States. Summarize in a statement that the
leaders of sanctuary cities are people without conscience and
without any respect for the American Constitution. (Preliminary
translation of Russian text.)
k. Citing an online news article titled “Dobbs Slams McConnell, Says It’s Time to
‘Ditch Mitch,’” from on or about August 8, 2017, a member of the Conspiracy
directed that the article be messaged in the following way:
It’s time for Mitch McConnell (leader of the Senate Republicans)
to retire. Show solid support for the news anchor. Emphasize that
McConnell exhausted himself as a politician. State that Mitch
McConnell, like many other Republican senators, behaves as a
renegade and a vile liberal. McConnell has done nothing to fulfill
Trump’s and other Republicans’ election promises. Remind that
McConnell is a friend of Joe Biden, who has no political
principles. Emphasize that boycotting the conservative agenda is
the most inadequate and treacherous behavior possible in the given
situation. Summarize in a statement that people did not vote for the
Republicans in 2014 and in 2016 so that today they would do the
same things that Democrats usually busy themselves
with. (Preliminary translation of Russian text.)
C. Use of Specific U.S. Fake Personas
29. Since at least in or around 2015, the Conspiracy used social media platforms to
create thousands of social media and email accounts that appeared to be operated by U.S.
persons and used them to create and amplify divisive social and political content targeting a U.S.
Page 19 of 38
Page 33 PagelD#
audience. These accounts were also used to advocate for the election or electoral defeat of
particular candidates in the 2016 and 2018 U.S. elections, to post derogatory information about a
number of candidates, and, on occasion, to promote political donations against particular
candidates.
30. In or around May 2015, the Conspiracy created a Facebook account registered
under the false U.S. persona “Helen Christopherson.” On her Facebook page, “Helen
Christopherson” purported to be a resident of New York City and identified her hometown as
Charleston, South Carolina. Between in or around March 2016 and in or around July 2017,
while concealing its true identity, location, and purpose, the Conspiracy used the false U.S.
persona “Helen Christopherson” to contact individuals and groups in the United States to
promote protests, rallies, and marches, including by funding advertising, flyers, and rally
supplies. Specific examples of this account’s activities, as well as the activities of other accounts
described in this subsection, are contained in the Overt Acts section below.
Sik In or around June 2015, the Conspiracy created a Facebook account registered
under the false U.S. persona “Bertha Malone.” On her Facebook page, “Bertha Malone”
purported to be a resident of New York City, identified her hometown as New York City, and
stated that she had attended a university in New York City. i or around January 2016, the
Conspiracy used the “Bertha Malone” Facebook account to create a Facebook page for a group
called “Stop A.L,” which is an abbreviation for “Stop All Invaders.” Between in or around
December 2016 and in or around August 2017, while concealing its true ‘dantity, location, and
purpose, the Conspiracy used the “Bertha Malone” Facebook account to create over 400 posts on
Facebook containing inflammatory political and social content focused primarily on immigration
_ and Islam, Between on or about July 17, 2017, and on or about July 23, 2017, alone, the content
Page 20 of

oe ngs
Page 34 PagelD#
on the “Stop A.I.” Facebook page reached approximately 1,385,795 individuals and
approximately 130,851 individuals purposefully engaged with the Facebook page. In total, by on
or about July 23, 2017, the Facebook page received approximately 194,221 total page likes.
32. The Conspiracy also used the “Bertha Malone” Facebook account, while
concealing its true identity, location, and purpose, to solicit at least one person presumed to be
located in the United States to assist with Project Lakhta’s social media activities in or around
July 2017, such as by posting and managing content on the “Stop A.I.” Facebook page.
Moreover, the Conspiracy used the “Stop A.I.” Facebook page to accept money from individuals
to post ads and other content on the Facebook group’s page.
33. In or around June 2016, the Conspiracy created a Twitter account that went by
various names, including “@UsaUsafortrump,” “@USAForDTrump,” “@TrumpWithUSA,”
“@TrumpMovy,” “@POTUSADIT,” “@imdeplorable201,” “epvanipdeaineteeo.”
“@maga2017trump,” and “@TXCowboysRawk.” Most recently, the Twitter account went by
the name “@CovfefeNationUS.” Between in or around November 2017 and in or around
December 2017, while concealing its true identity, location, and purpose, the Conspiracy used
the Twitter account “@CovfefeNationUS” to post or repost over 23,000 messages.
34. Inor around September 2016, the Conspiracy created a Facebook account
registered under the false US. persona “Rachell Edison” and an associated Facebook page for a
group called “Defend the 2nd.” Between in or around December 2016 and in or around May
2017, while concealing its true identity, location, and purpose, the Conspiracy used the “Rachell
Edison” Facebook account to create over 700 posts on Facebook containing inflammatory
political and social content primarily focused on gun control and the Second Amendment.
Page 21 of 38
Page 35 PagelD#
35. In or around March 2017, the Conspiracy created the Twitter account
“@wokeluisa” registered under the false U.S. persona “Luisa Haynes.” Between in or around
March 2017 and in or around March 2018, while eencedlin g its true identity, location, and
purpose, the Conspiracy used the Twitter account “@wokeluisa” to post over 2,000 Tweets on
topics such as the 2018 midterm election, the disenfranchisement of African-American voters,
the NFL national anthem debate, the current U.S. administration, and the U.S. President’s family.
By in or around March 2018, the Twitter account amassed over 55,000 followers.
36. In or around September 2017, the Conspiracy created several Twitter accounts
that it used to create and amplify content that would resonate with either liberal or conservative
audiences. For example, on or about September 4, 2017, one or more members of the
Conspiracy created the Twitter accounts “@JohnCopper16,” “@Amconvoice,” and
“@TheTrainGuy13.” Members of the Conspiracy used these accounts to post messages on
controversial social and political topics using a perspective that they believed would resonate
with a conservative audience in the United States. Similarly, one or more members of the
Conspiracy created the Twitter account “@KaniJJackson” on or about September 5, 2017, and
the Twitter account “@JemiSHaaaZzz” on or about September 6, 2017, and used these accounts
to post on many of the same controversial social and political topics from a perspective that they
believed would resonate with a liberal audience in the United States. Between in or around
September 2017 and in or around May 2018, while concealing its true identity, location, and
purpose, the Conspiracy used these Twitter accounts to post thousands of Tweets, on topics
including, but not limited to, the 2018 midterm election, gun rights, the net neutrality debate,
negotiations with North Korea, and the personnel and policy decisions of the current U.S.
administration. In some cases, these accounts attracted significant numbers of followers. For
Page 22 of 38
Page 36 PagelD#
example, by in or around May 2018, the Twitter account “@KaniJJackson” had amassed over
33,000 followers.
| IV. Overt Acts
37. Between in or around December 2016 and in or around May 2018, in the Eastern
District of Virginia and elsewhere, while concealing its true identity, location, and purpose, the
Conspiracy committed the following overt acts involving U.S. social media platforms in
furtherance of the Conspiracy and to effect its illegal objects:
38. | Onor about December 5, 2016, a member of the Conspiracy used the “Rachell
Edison” Facebook account to post the following image on Facebook, accompanied by the
comment “Whatever happens, blacks are innocent. Whatever happens, it’s all guns and cops.
Whatever happens, it’s all racists and homophobes. MainStream Media...”
AL:
MAN KILLED WITH FIREARM
Wa
mT SST Oe ta
Ts GE Vane yey
"S (gpDEreND |i
THE 2ND
Looe
A DIFFERENT RAGE?
a
Ua OAM MC mS
JUDGMENT

Page 23 of 38
Page 37 PagelD#
39. Onor about April 28, 2017, a member of the Conspiracy used the “Rachell
Edison” Facebook account to post the following image on Facebook:
ATEN 10 WM
ELEGTION|WINS|INTO|PERMAN
(GUN|RIGHTS}FORPAMERIGANS;









fe!






oil






































Chris W. Cox, executive roe fo Au
AES EL ern ATaLTP
ae
The image was accompanied by the following comment advocating political activities:
Gun rights backers need to make sure that election victories translate into
action on Capitol Hill and expanded support in the states, the National Rifle
Association’s legislative chief said Thursday, a day ahead of President
Trump’s speech at the NRA’s annual convention. And he is absolutely right.
Now it is the time for us to demand our rights. With current, administration it
is possible to defend our right to bear arms. I think next 4 years will be great
for all Americans, and for gun lovers especially! But we must stand for our
rights! And in the end, I believe, we will win!
40. On or about July 1, 2017, a member of the Conspiracy used the “Helen
Christopherson” Facebook account to contact the Facebook accounts for three real U.S.
organizations (hereinafter U.S. Organizations 1, 2, and 3) to inquire about collaborating with
Page 24 of 38
Page 38 PagelD#
these groups on an anti-President Trump “flash mob” at the White House, which was already
being organized by the groups for July 4, 2017. The organizers had described the event as
“inviting resistance activists, show tune lovers, and karaoke fans to come join us on
Independence Day, sing a song of freedom, and demand Trump’s impeachment.”
41.- Onor about July 2, 2017, a member of the Conspiracy used the “Helen
Christopherson” Facebook account to contact U.S, Organization | and a U.S. person affiliated
with the organization, U.S. Person 1, and inform them that “I got some cash on my Facebook ad
account so we can promote it for 2 days,” adding “I got like $80 on my ad account so we can
reach like 10000 people in DC or so. That would be Massive!”
Page 25 of
Page 39 PagelD#
42. Onor about July 2, 2017, a member of the Conspiracy used the “Helen
Christopherson” Facebook account to send U.S. Organization | a proposal to purchase
advertising targeting individuals within 30 miles of Washington, DC, including significant
portions of the Eastern District of Virginia, as depicted below:




‘ou \ how ‘Sdsito your comacts, ‘
ebsit stn or app ser. create 2 Cusfom AuaiEnee.
tne
Locations © = Peaple who five in this location + :

|

| ° Wertingem. District of Columbia + 30m ¥ e :
@ include ~ | Type to atid more tocations | Browse |
{ -o
Your audience location has been changed from ‘Washington, x ;
District of Columbia to Geiger Undo eae {
ase ‘cannon ‘Sear ve
fee Meee “\aaeei
Te ae titan Ty Ie

Mow?
> Seaton Wiles F icant orev
& chalittl thaahh vashinggton a
} Certeieyal hence” Suite.
| } Batty pAlelapacrja Maretplieg. 7 ‘ ; - CSrtarr! :
; alee
Bf Prt :
. = tatket
| oa Be a
a ae
i o-
i ws
Add Bulk Locations.
Age We - Bw
The proposed advertisements had an estimated reach of 29,000 to 58,000 individuals.
Subsequently, U.S. Organization 1 agreed to make the “Helen Christopherson” Facebook
account a co-organizer of the event on Facebook.
Page 26 of 38
Page 40 PageIlD#
43. Onor about July 4, 2017, a member of the Conspiracy used the “Bertha Malone”
Facebook account to engage in the following conversation with U.S. Person 2 about U.S. Person
2 assisting with posting content and managing the “Stop A.I.” Facebook page, which members of
the Conspiracy controlled:
Malone: Hey girl! How u doin? still got free time on ya hands?
So...remember u wanted to help me with that page i’m workng
on? It’s a little bit unorthodox, but nwm that. Content is not of
my choosing. So what tell ya? Help a sister out?
U.S. Person 2: Hi! Let me think bout 4 a sec.
what’s the name of the page again?
Malone: https://www.facebook.com/StopAllInvaders/
Malone: Nothin muh, [U.S. Person 2]. Just general scannin, answer
subcribers now and then and mb post something (i’ll be sending
content to u directly)
Malone: nwm the posts lol
Malone: just business
Malone: makes ratinging for clients, that’s what 1 know.
Malone: ratings*
Malone: u know how rednecks are
Malone: so here’s the deal. I give u admin rights, u check the page when
i’m not around and basically do some stuff i tell u to :D
U.S. Person 2: You know I can’t let my sis down
U.S. Person 2: so I’m in
U.S. Person 2: but please tell me I’m not going to jail for this
Malone: jeez why would u
Malone: just page lol
Malone: il] vouch fou 4 mb u get some money out that even
U.S. Person 2: i trust you
Page 27 of
cope
Page 41 PagelD#
44. On or about July 28, 2017, a member of the Conspiracy used the “Bertha Malone”
Facebook account to post the following image on Facebook:
Pie toes
J
IF ONLY anata SU a
AS THEY ARE BY TRUMP'S FAKE TIES TO RUSSIA.

Sa aT
The image was accompanied by the following comment:
Instead this stupid witch hunt on Trump, media should investigate this
traitor and his plane to Islamize our country. If you are true enemy of
America, take a good look at Barack Hussein Obama and Muslim
government officials appointed by him.
“Page 28 of 38
Page 42 PagelD#
45. Onor about July 31, 2017, a member of the Conspiracy used the “Bertha Malone”
Facebook account to post the following image on Facebook, with the comment “Stop separating
families! Deport them all, including their anchor babies! And spend saved money on Americans
who really need it, for example our homeless Vets”:
aa ILLEGAL HOUSEHOLD
STEM YL
a om ¥
i
Ae ae ae oe
NS TT Ua
ae
CI a

Page 29 of 38
Page 43 ~ PagelD#
46. Onor about July 31, 2017, a member of the Conspiracy used the “Bertha Malone”
_ Facebook account to post the following image on Facebook, with the comment “Feel the
difference!”’:
FIRST FIVE MONTHS FIRST FIVE MONTHS
OF THE OBAMA felanaticnr yl
ADMINISTRATION ADMINISTRATION

Page 30 of 38
Page 44 PagelD#
47. On or about August 1, 2017, a member of the Conspiracy used the “Bertha
Malone” Facebook account to post the following image on Facebook, with the comment “Damn
right! And we all know which cult we need to kick out of America...”:
a Ee
RS
aa
— TO EXIST WITHIN THE
SAME WESTERN COUNTRIES
PS

The post generated approximately 104 comments between on or around August 1, 2017, and on
or around August 2, 2017.
Page 31 of 38
Page 45 PagelD#
48. Onor about December 10, 2017, a member of the Conspiracy used the Twitter
account “@CovfefeNationUS” to repost a Tweet encouraging readers to donate to a political
action committee aiming to unseat Democratic Senators and Representatives in the midterm election:
Tell us who you want to defeat! Donate $1.00 to defeat @daveloebsack
Donate $2.00 to defeat @SenatorBaldwin Donate $3.00 to defeat
@clairecme Donate $4.00 to defeat @NancyPelosi Donate $5.00 to defeat
@RepMaxineWaters Donate $6.00 to defeat @SenWarren
The Tweet included a link to the donation website of a political action committee.
49. On or about December 12, 2017, a member of the Conspiracy used the Twitter
account ““@KaniJJackson” to post a Tweet about the 2017 special election in Alabama:
Dear Alabama, You have a choice today. Doug Jones put the KKK in
prison for murdering 4 young black girls. Roy Moore wants to sleep with
your teenage daughters. This isn't hard. #AlabamaSenate
50. | Onor about December 12, 2017, a member of the Conspiracy used the Twitter
account “@JohnCopper16” to post a Tweet about the 2017 special election in Alabama:
People living in Alabama have different values than people living in NYC.
They will vote for someone who represents them, for someone who they
can trust. Not you. Dear Alabama, vote for Roy Moore.
Sl, On or about December 1| 6, 2017, a member of the Conspiracy used the Twitter
account “(@KaniJJackson” to post a Tweet about the Special Counsel’s Office’s investigation:
If Trump fires Robert Mueller, we have to take to the streets in protest.
Our democracy is at stake.
52. On or about December 17, 2017, a member of the Conspiracy used the Twitter
account “@Amconvoice” to repost a Tweet about the Special Counsel’s Office’s investigation:
Liberals : If Trump fire/removes Mueller, we will take to the
streets/protest. (DNC must have sent that talking point out today.
Everyone using same line) Why would Trump need to remove/fire
Mueller, Mueller is doing fine job destroying himself. Keep the implosion
coming Mueller.
Page 32 of 38
Page 46 PagelD#
On or about January 19, 2018, a member of the Conspiracy used the Twitter
account “@KaniJJackson” to post a Tweet about the government shutdown of 2018:
54,
Who ended DACA? Who put off funding CHIP for 4 months? Who
rejected a deal to restore DACA? It's not #SchumerShutdown. It's
#GOPShutdown.
On or about January 20, 2018, a member of the Conspiracy used the Twitter
account “@JohnCopper16” to repost a Tweet about the government shutdown of 2018:
55.
Anyone who believes that President Trump is responsible for the
#shutdown2018 is either an outright liar or horribly ignorant.
#SchumerShutdown for illegals. #DemocratShutdown #DemocratLosers
#DemocratsDefundMilitary #AlternativeFacts
On or about January 26, 2018, a member of the Conspiracy used the Twitter
account “@JemiSHaaaZzz” to repost a Tweet about a Senate vote on reproductive health issues,
referencing the telephone number of the U.S. Capitol switchboard:
56.
Sa
At .
tesa Republicans have scheduled a vote Monday on legislation that would

ban some women’s health care choices m===s
We can't turn back the clock on women’s reproductive health. Call your
Senators now and tell them to vote NO: (202) 224-3121.
On or about February 8, 2018, a member of the Conspiracy used the Twitter
account “@Amconvoice” to post a Tweet about the 2018 U.S. midterm election:
The only way the Democrats can win 101 GOP seats is to cheat like they
always do with illegals & dead voters.
Page 33 of 38
Page 47 PagelD#
57. Onor about February 15, 2018, a member of the Conspiracy used the Twitter
account “@KaniJJackson” to post a Tweet about the Parkland, Florida, school shooting and the
2018 U.S. midterm election:
Reminder: the same GOP that is offering thoughts and prayers today are
the same ones that voted to allow loosening gun laws for the mentally ill
last February. If you're outraged today, VOTE THEM OUT IN 2018.
#guncontrol #Parkland
58. On or about February 16, 2018, a member of the Conspiracy used the Twitter
account “@JemiSHaaaZzz” to repost a Tweet about the Special Counsel's Office’s indictment of
Russian companies and nationals who sought to interfere with U.S. elections and political
processes:
Dear @realDonaldTrump: The DOJ indicted 13 Russian nationals at the
Internet Research Agency for violating federal criminal law to help your
campaign and hurt other campaigns. Still think this Russia thing is a hoax
and a witch hunt? Because a lot of witches just got indicted.
59. Onor about February 16, 2018, a member of the Conspiracy used the Twitter
account “@JohnCopper16” to post two Tweets about the Special Counsel’s Office’s indictment:
Russians indicted today: 13 Illegal immigrants crossing Mexican border indicted
today: 0 Anyway, I hope that all those Internet Research Agency f*ckers will be
sent to gitmo.
We didn't vote for Trump because of a couple of hashtags shilled by the Russians.
We voted for Trump because he convinced us to vote for Trump. And we are
ready to vote for Trump again in 2020!
60. Onor about February 19, 2018, a member of the Conspiracy used the Twitter
account “@KaniJJackson” to post a Tweet about the 2018 midterm election:
Midterms are in 261 days, use this time to: - Promote your candidate on
social media - Volunteer for a campaign - Donate to a campaign - Register
to vote - Help others to register to vote - Spread the word We have only
261 days to guarantee survival of democracy. Get to work!
Page 34 of 38
Page 48 PagelD#
61. Onor about February 27, 2018, a member of the Conspiracy used the Twitter
account “@JohnCopper16” to post the following Tweet about the 2018 midterm election:
Dem 2018 platform: - We want women raped by the jihadists - We want
children killed - We want higher gas prices - We want more illegal aliens
- We want more Mexican drugs And they are wondering why
@realDonaldTrump became the President...
62. | Onor about March 9, 2018, a member of the Conspiracy used the Twitter account
“@JohnCopper| 6” to post the following two Tweets about the summit between President Trump
and North Korean President Kim Jong Un:
WOW! Donald Trump is going to meet Kim Jong Un to discuss
denuclearization of North Korea, If Trump gets North Korea to
denuclearize its game over for the Democrats! That would be
monumental!
RETWEET if you think that Donald Trump deserves a Nobel Peace Prize
for resolving the North Korean crisis!
63. | Onor about March 9, 2018, a member of the Conspiracy used the Twitter account
“@KaniJJackson” to post the following two Tweets about the summit between President Trump
and North Korean President Kim Jong Un:
Trump says he will meet with Kim Jong Un in May. But he might not
even be president by then. Mueller is coming!
The same people who criticized Barack Obama for signing the Iran
Nuclear deal are already praising Trump for his promise to meet with Kim
Jong Un and talk about denuclearization,
64. On or about March 14, 2018, a member of the Conspiracy used the Twitter
account “@wokeluisa” to post several Tweets regarding the Pennsylvania special election on
March 13, 2018, for a House of Representatives seat:
Enthusiastically watching #PA18 turn blue
Lamb up by only 703 votes... EVERY. VOTE. COUNTS. #PA
Page 35 of 38
Page 49 PagelD#
65.
We need to flip about 20 seats to regain control of the House! 19 after
tonight! #PA
Tonight’s results are a message regardless of the outcome: D voters are
motivated! Blue Wave coming! #PA
On or about March 14, 2018, a member of the Conspiracy used the Twitter
account “@TheTrainGuy 13” to repost a Tweet about voter fraud:

a


= VOTER FRAUD
/ a IS A FELONY
HOLD THEM ACCOUNTABLE


FIGHT FIGHT
FIGHT .@realDonaldTrump .@POTUS

Page 36 of 38
Page 50 PagelD#
66.
On or about March 18, 2018, a member of the Conspiracy used the Twitter
account “@wokeluisa” to post the following Tweet about election fraud:
67.
Fun fact: the last time a new Republican president was elected without
electoral fraud was in
On or about March 18, 2018, a member of the Conspiracy used the Twitter
account “@wokeluisa” to repost the following Tweet:
68.
Just a reminder that: - Majority black Flint, Michigan still has drinking
water that will give you brain damage if consumed. - Republicans are still
trying to keep black people from voting. - A terrorist has been targeting
black families for assasination in Austin, Texas.
On or about March 19, 2018, a member of the Conspiracy used the Twitter
account “@wokeluisa” to post the following Tweets about an explosion in Austin, Texas:
69.
Trump will tweet NOTHING about yet another explosion in Austin b/c all
of the victims have been black and hispanic. Mark my words
Another explosion in southwest Austin, Texas! Why these bombings ain’t
a bigger story? Oh yes... all of the victims have been Black and Hispanic
#AustinBombings
On or about March 19, 2018, a member of the Conspiracy used the Twitter
account “@wokeluisa” to post the following Tweet about the 2018 midterm election:
70.
Make sure to pre-register to vote if you are 16 y.o. or older. Don’t just sit
back, do something about everything that’s going on because November 6,
2018 is the date that 33 senate seats, 435 seats in the House of
Representatives and 36 governorships will be up for re-election.
On or about March 22, 2018, a member of the Conspiracy used the Twitter
account “@johncopper16” to post the following Tweet about the 2018 midterm election:
Just a friendly reminder to get involved in the 2018 Midterms. They are
motivated They hate you They hate your morals They hate your 1A and 2A
rights They hate the Police They hate the Military They hate YOUR President
Page 37 of 38
Page 51 PagelD#
71. On or about May 17, 2018, a member of the Conspiracy used the Twitter account
“@KaniJJackson” to repost two Tweets about a U.S. Senate vote on Net Neutrality:
Ted Cruz voted to repeal #NetNeutrality. Let’s save it and repeal him instead.
Here’s the list of GOP senators who broke party lines and voted to save
#NetNeutrality: Susan Collins John N Kennedy Lisa Murkowski Thank you!
CONCLUSION
72. Based on the foregoing, and on my training, experience, and participation in this
and other investigations, I submit there is probable cause to believe that, from at least 2014 to the
present, ELENA ALEKSEEVNA KHUSYAYNOVA has violated Title 18, United States Code,

Section 371.
David Holt ~
Special Agent
Federal Bureau of Investigation
Reviewed by:
Jay V. Prabhu
Chief, Cybercrime Unit
Assistant U.S. Attorney
Alex Iftimie
Special Assistant U.S. Attorney
Sworn to before me this Ag th day
of September,
KA Is/ |
Ivan D. Davis
United States Magistrate Judge
Page 38 of 38
Space
Issues Laws Cases Pro Articles Firms Entities
Issues Laws Cases Pro Articles Firms Entities
 
PlainSite
Sign Up
Need Password Help?